authz_checks.go

// Code generated by entfga, DO NOT EDIT.

// Code generated by ent, DO NOT EDIT.

package generated

import (
	"context"

	"entgo.io/ent/privacy"
	"github.com/99designs/gqlgen/graphql"
	"github.com/datumforge/datum/internal/ent/generated/group"
	"github.com/datumforge/datum/internal/ent/generated/groupmembership"
	"github.com/datumforge/datum/internal/ent/generated/groupsetting"
	"github.com/datumforge/datum/internal/ent/generated/organization"
	"github.com/datumforge/datum/internal/ent/generated/organizationsetting"
	"github.com/datumforge/datum/internal/ent/generated/orgmembership"
	"github.com/datumforge/datum/internal/ent/generated/webhook"
	"github.com/datumforge/datum/pkg/auth"
	"github.com/datumforge/fgax"
)

func (q *APITokenQuery) CheckAccess(ctx context.Context) error {
	gCtx := graphql.GetFieldContext(ctx)

	if gCtx != nil {
		ac := fgax.AccessCheck{
			Relation:    fgax.CanView,
			ObjectType:  "organization",
			SubjectType: auth.GetAuthzSubjectType(ctx),
		}

		// check id from graphql arg context
		// when all objects are requested, the interceptor will check object access
		// check the where input first
		whereArg := gCtx.Args["where"]
		if whereArg != nil {
			where, ok := whereArg.(*APITokenWhereInput)
			if ok && where != nil && where.OwnerID != nil {
				ac.ObjectID = *where.OwnerID
			}
		}

		// if that doesn't work, check for the id in the args
		if ac.ObjectID == "" {
			ac.ObjectID, _ = gCtx.Args["ownerid"].(string)
		}

		// if we still don't have an object id, run the query and grab the object ID
		// from the result
		// this happens on join tables where we have the join ID (for updates and deletes)
		// and not the actual object id
		if ac.ObjectID == "" && "id" != "ownerid" {
			// allow this query to run
			reqCtx := privacy.DecisionContext(ctx, privacy.Allow)
			ob, err := q.Clone().Only(reqCtx)
			if err != nil {
				return privacy.Allowf("nil request, bypassing auth check")
			}
			ac.ObjectID = ob.OwnerID
		}

		// request is for a list objects, will get filtered in interceptors
		if ac.ObjectID == "" {
			return privacy.Allowf("nil request, bypassing auth check")
		}

		var err error
		ac.UserID, err = auth.GetUserIDFromContext(ctx)
		if err != nil {
			return err
		}

		access, err := q.Authz.CheckAccess(ctx, ac)
		if err != nil {
			return privacy.Skipf("unable to check access, %s", err.Error())
		}

		if access {
			return privacy.Allow
		}
	}

	// Skip to the next privacy rule (equivalent to return nil)
	return privacy.Skip
}

func (m *APITokenMutation) CheckAccessForEdit(ctx context.Context) error {
	ac := fgax.AccessCheck{
		Relation:    fgax.CanEdit,
		ObjectType:  "organization",
		SubjectType: auth.GetAuthzSubjectType(ctx),
	}
	orgID, oErr := auth.GetOrganizationIDFromContext(ctx)
	if oErr != nil {
		return oErr
	}

	ac.ObjectID = orgID

	// request is for a list objects, will get filtered in interceptors
	if ac.ObjectID == "" {
		return privacy.Allowf("nil request, bypassing auth check")
	}

	m.Logger.Debugw("checking mutation access")

	var err error
	ac.UserID, err = auth.GetUserIDFromContext(ctx)
	if err != nil {
		return err
	}

	m.Logger.Infow("checking relationship tuples", "relation", ac.Relation, "object_id", ac.ObjectID)

	access, err := m.Authz.CheckAccess(ctx, ac)
	if err != nil {
		return privacy.Skipf("unable to check access, %s", err.Error())
	}

	if access {
		m.Logger.Debugw("access allowed", "relation", ac.Relation, "object_id", ac.ObjectID)

		return privacy.Allow
	}

	// deny if it was a mutation is not allowed
	return privacy.Deny
}

func (m *APITokenMutation) CheckAccessForDelete(ctx context.Context) error {
	ac := fgax.AccessCheck{
		Relation:    fgax.CanDelete,
		ObjectType:  "organization",
		SubjectType: auth.GetAuthzSubjectType(ctx),
	}

	gCtx := graphql.GetFieldContext(ctx)

	var ok bool
	ac.ObjectID, ok = gCtx.Args["id"].(string)
	if !ok {
		return privacy.Allowf("nil request, bypassing auth check")
	}

	m.Logger.Debugw("checking mutation access")

	var err error
	ac.UserID, err = auth.GetUserIDFromContext(ctx)
	if err != nil {
		return err
	}

	m.Logger.Infow("checking relationship tuples", "relation", ac.Relation, "object_id", ac.ObjectID)

	access, err := m.Authz.CheckAccess(ctx, ac)
	if err != nil {
		return privacy.Skipf("unable to check access, %s", err.Error())
	}

	if access {
		m.Logger.Debugw("access allowed", "relation", ac.Relation, "object_id", ac.ObjectID)

		return privacy.Allow
	}

	// deny if it was a mutation is not allowed
	return privacy.Deny
}

func (q *GroupQuery) CheckAccess(ctx context.Context) error {
	gCtx := graphql.GetFieldContext(ctx)

	if gCtx != nil {
		ac := fgax.AccessCheck{
			Relation:    fgax.CanView,
			ObjectType:  "group",
			SubjectType: auth.GetAuthzSubjectType(ctx),
		}

		// check id from graphql arg context
		// when all objects are requested, the interceptor will check object access
		// check the where input first
		whereArg := gCtx.Args["where"]
		if whereArg != nil {
			where, ok := whereArg.(*GroupWhereInput)
			if ok && where != nil && where.ID != nil {
				ac.ObjectID = *where.ID
			}
		}

		// if that doesn't work, check for the id in the args
		if ac.ObjectID == "" {
			ac.ObjectID, _ = gCtx.Args["id"].(string)
		}

		// if we still don't have an object id, run the query and grab the object ID
		// from the result
		// this happens on join tables where we have the join ID (for updates and deletes)
		// and not the actual object id
		if ac.ObjectID == "" && "id" != "id" {
			// allow this query to run
			reqCtx := privacy.DecisionContext(ctx, privacy.Allow)
			ob, err := q.Clone().Only(reqCtx)
			if err != nil {
				return privacy.Allowf("nil request, bypassing auth check")
			}
			ac.ObjectID = ob.ID
		}

		// request is for a list objects, will get filtered in interceptors
		if ac.ObjectID == "" {
			return privacy.Allowf("nil request, bypassing auth check")
		}

		var err error
		ac.UserID, err = auth.GetUserIDFromContext(ctx)
		if err != nil {
			return err
		}

		access, err := q.Authz.CheckAccess(ctx, ac)
		if err != nil {
			return privacy.Skipf("unable to check access, %s", err.Error())
		}

		if access {
			return privacy.Allow
		}
	}

	// Skip to the next privacy rule (equivalent to return nil)
	return privacy.Skip
}

func (m *GroupMutation) CheckAccessForEdit(ctx context.Context) error {
	ac := fgax.AccessCheck{
		Relation:    fgax.CanEdit,
		ObjectType:  "group",
		SubjectType: auth.GetAuthzSubjectType(ctx),
	}

	gCtx := graphql.GetFieldContext(ctx)

	// check the id from the args
	if ac.ObjectID == "" {
		ac.ObjectID, _ = gCtx.Args["id"].(string)
	}

	// if this is still empty, we need to query the object to get the object id
	// this happens on join tables where we have the join ID (for updates and deletes)
	if ac.ObjectID == "" && "id" != "id" {
		id, ok := gCtx.Args["id"].(string)
		if ok {
			// allow this query to run
			reqCtx := privacy.DecisionContext(ctx, privacy.Allow)
			ob, err := m.Client().Group.Query().Where(group.ID(id)).Only(reqCtx)
			if err != nil {
				return privacy.Skipf("nil request, skipping auth check")
			}
			ac.ObjectID = ob.ID
		}
	}

	// request is for a list objects, will get filtered in interceptors
	if ac.ObjectID == "" {
		return privacy.Allowf("nil request, bypassing auth check")
	}

	m.Logger.Debugw("checking mutation access")

	var err error
	ac.UserID, err = auth.GetUserIDFromContext(ctx)
	if err != nil {
		return err
	}

	m.Logger.Infow("checking relationship tuples", "relation", ac.Relation, "object_id", ac.ObjectID)

	access, err := m.Authz.CheckAccess(ctx, ac)
	if err != nil {
		return privacy.Skipf("unable to check access, %s", err.Error())
	}

	if access {
		m.Logger.Debugw("access allowed", "relation", ac.Relation, "object_id", ac.ObjectID)

		return privacy.Allow
	}

	// deny if it was a mutation is not allowed
	return privacy.Deny
}

func (m *GroupMutation) CheckAccessForDelete(ctx context.Context) error {
	ac := fgax.AccessCheck{
		Relation:    fgax.CanDelete,
		ObjectType:  "group",
		SubjectType: auth.GetAuthzSubjectType(ctx),
	}

	gCtx := graphql.GetFieldContext(ctx)

	var ok bool
	ac.ObjectID, ok = gCtx.Args["id"].(string)
	if !ok {
		return privacy.Allowf("nil request, bypassing auth check")
	}

	m.Logger.Debugw("checking mutation access")

	var err error
	ac.UserID, err = auth.GetUserIDFromContext(ctx)
	if err != nil {
		return err
	}

	m.Logger.Infow("checking relationship tuples", "relation", ac.Relation, "object_id", ac.ObjectID)

	access, err := m.Authz.CheckAccess(ctx, ac)
	if err != nil {
		return privacy.Skipf("unable to check access, %s", err.Error())
	}

	if access {
		m.Logger.Debugw("access allowed", "relation", ac.Relation, "object_id", ac.ObjectID)

		return privacy.Allow
	}

	// deny if it was a mutation is not allowed
	return privacy.Deny
}

func (q *GroupMembershipQuery) CheckAccess(ctx context.Context) error {
	gCtx := graphql.GetFieldContext(ctx)

	if gCtx != nil {
		ac := fgax.AccessCheck{
			Relation:    fgax.CanView,
			ObjectType:  "group",
			SubjectType: auth.GetAuthzSubjectType(ctx),
		}

		// check id from graphql arg context
		// when all objects are requested, the interceptor will check object access
		// check the where input first
		whereArg := gCtx.Args["where"]
		if whereArg != nil {
			where, ok := whereArg.(*GroupMembershipWhereInput)
			if ok && where != nil && where.GroupID != nil {
				ac.ObjectID = *where.GroupID
			}
		}

		// if that doesn't work, check for the id in the args
		if ac.ObjectID == "" {
			ac.ObjectID, _ = gCtx.Args["groupid"].(string)
		}

		// if we still don't have an object id, run the query and grab the object ID
		// from the result
		// this happens on join tables where we have the join ID (for updates and deletes)
		// and not the actual object id
		if ac.ObjectID == "" && "id" != "groupid" {
			// allow this query to run
			reqCtx := privacy.DecisionContext(ctx, privacy.Allow)
			ob, err := q.Clone().Only(reqCtx)
			if err != nil {
				return privacy.Allowf("nil request, bypassing auth check")
			}
			ac.ObjectID = ob.GroupID
		}

		// request is for a list objects, will get filtered in interceptors
		if ac.ObjectID == "" {
			return privacy.Allowf("nil request, bypassing auth check")
		}

		var err error
		ac.UserID, err = auth.GetUserIDFromContext(ctx)
		if err != nil {
			return err
		}

		access, err := q.Authz.CheckAccess(ctx, ac)
		if err != nil {
			return privacy.Skipf("unable to check access, %s", err.Error())
		}

		if access {
			return privacy.Allow
		}
	}

	// Skip to the next privacy rule (equivalent to return nil)
	return privacy.Skip
}

func (m *GroupMembershipMutation) CheckAccessForEdit(ctx context.Context) error {
	ac := fgax.AccessCheck{
		Relation:    fgax.CanEdit,
		ObjectType:  "group",
		SubjectType: auth.GetAuthzSubjectType(ctx),
	}

	gCtx := graphql.GetFieldContext(ctx)

	// get the input from the context
	gInput := gCtx.Args["input"]

	// check if the input is a CreateGroupMembershipInput
	input, ok := gInput.(CreateGroupMembershipInput)
	if ok {
		ac.ObjectID = input.GroupID

	}

	// check the id from the args
	if ac.ObjectID == "" {
		ac.ObjectID, _ = gCtx.Args["groupid"].(string)
	}

	// if this is still empty, we need to query the object to get the object id
	// this happens on join tables where we have the join ID (for updates and deletes)
	if ac.ObjectID == "" && "id" != "groupid" {
		id, ok := gCtx.Args["id"].(string)
		if ok {
			// allow this query to run
			reqCtx := privacy.DecisionContext(ctx, privacy.Allow)
			ob, err := m.Client().GroupMembership.Query().Where(groupmembership.ID(id)).Only(reqCtx)
			if err != nil {
				return privacy.Skipf("nil request, skipping auth check")
			}
			ac.ObjectID = ob.GroupID
		}
	}

	// request is for a list objects, will get filtered in interceptors
	if ac.ObjectID == "" {
		return privacy.Allowf("nil request, bypassing auth check")
	}

	m.Logger.Debugw("checking mutation access")

	var err error
	ac.UserID, err = auth.GetUserIDFromContext(ctx)
	if err != nil {
		return err
	}

	m.Logger.Infow("checking relationship tuples", "relation", ac.Relation, "object_id", ac.ObjectID)

	access, err := m.Authz.CheckAccess(ctx, ac)
	if err != nil {
		return privacy.Skipf("unable to check access, %s", err.Error())
	}

	if access {
		m.Logger.Debugw("access allowed", "relation", ac.Relation, "object_id", ac.ObjectID)

		return privacy.Allow
	}

	// deny if it was a mutation is not allowed
	return privacy.Deny
}

func (m *GroupMembershipMutation) CheckAccessForDelete(ctx context.Context) error {
	ac := fgax.AccessCheck{
		Relation:    fgax.CanDelete,
		ObjectType:  "group",
		SubjectType: auth.GetAuthzSubjectType(ctx),
	}

	gCtx := graphql.GetFieldContext(ctx)

	var ok bool
	ac.ObjectID, ok = gCtx.Args["id"].(string)
	if !ok {
		return privacy.Allowf("nil request, bypassing auth check")
	}

	m.Logger.Debugw("checking mutation access")

	var err error
	ac.UserID, err = auth.GetUserIDFromContext(ctx)
	if err != nil {
		return err
	}

	m.Logger.Infow("checking relationship tuples", "relation", ac.Relation, "object_id", ac.ObjectID)

	access, err := m.Authz.CheckAccess(ctx, ac)
	if err != nil {
		return privacy.Skipf("unable to check access, %s", err.Error())
	}

	if access {
		m.Logger.Debugw("access allowed", "relation", ac.Relation, "object_id", ac.ObjectID)

		return privacy.Allow
	}

	// deny if it was a mutation is not allowed
	return privacy.Deny
}

func (q *GroupSettingQuery) CheckAccess(ctx context.Context) error {
	gCtx := graphql.GetFieldContext(ctx)

	if gCtx != nil {
		ac := fgax.AccessCheck{
			Relation:    fgax.CanView,
			ObjectType:  "group",
			SubjectType: auth.GetAuthzSubjectType(ctx),
		}

		// check id from graphql arg context
		// when all objects are requested, the interceptor will check object access
		// check the where input first
		whereArg := gCtx.Args["where"]
		if whereArg != nil {
			where, ok := whereArg.(*GroupSettingWhereInput)
			if ok && where != nil && where.GroupID != nil {
				ac.ObjectID = *where.GroupID
			}
		}

		// if that doesn't work, check for the id in the args
		if ac.ObjectID == "" {
			ac.ObjectID, _ = gCtx.Args["groupid"].(string)
		}

		// if we still don't have an object id, run the query and grab the object ID
		// from the result
		// this happens on join tables where we have the join ID (for updates and deletes)
		// and not the actual object id
		if ac.ObjectID == "" && "id" != "groupid" {
			// allow this query to run
			reqCtx := privacy.DecisionContext(ctx, privacy.Allow)
			ob, err := q.Clone().Only(reqCtx)
			if err != nil {
				return privacy.Allowf("nil request, bypassing auth check")
			}
			ac.ObjectID = ob.GroupID
		}

		// request is for a list objects, will get filtered in interceptors
		if ac.ObjectID == "" {
			return privacy.Allowf("nil request, bypassing auth check")
		}

		var err error
		ac.UserID, err = auth.GetUserIDFromContext(ctx)
		if err != nil {
			return err
		}

		access, err := q.Authz.CheckAccess(ctx, ac)
		if err != nil {
			return privacy.Skipf("unable to check access, %s", err.Error())
		}

		if access {
			return privacy.Allow
		}
	}

	// Skip to the next privacy rule (equivalent to return nil)
	return privacy.Skip
}

func (m *GroupSettingMutation) CheckAccessForEdit(ctx context.Context) error {
	ac := fgax.AccessCheck{
		Relation:    fgax.CanEdit,
		ObjectType:  "group",
		SubjectType: auth.GetAuthzSubjectType(ctx),
	}

	gCtx := graphql.GetFieldContext(ctx)

	// get the input from the context
	gInput := gCtx.Args["input"]

	// check if the input is a CreateGroupSettingInput
	input, ok := gInput.(CreateGroupSettingInput)
	if ok {
		ac.ObjectID = *input.GroupID

	}

	// check the id from the args
	if ac.ObjectID == "" {
		ac.ObjectID, _ = gCtx.Args["groupid"].(string)
	}

	// if this is still empty, we need to query the object to get the object id
	// this happens on join tables where we have the join ID (for updates and deletes)
	if ac.ObjectID == "" && "id" != "groupid" {
		id, ok := gCtx.Args["id"].(string)
		if ok {
			// allow this query to run
			reqCtx := privacy.DecisionContext(ctx, privacy.Allow)
			ob, err := m.Client().GroupSetting.Query().Where(groupsetting.ID(id)).Only(reqCtx)
			if err != nil {
				return privacy.Skipf("nil request, skipping auth check")
			}
			ac.ObjectID = ob.GroupID
		}
	}

	// request is for a list objects, will get filtered in interceptors
	if ac.ObjectID == "" {
		return privacy.Allowf("nil request, bypassing auth check")
	}

	m.Logger.Debugw("checking mutation access")

	var err error
	ac.UserID, err = auth.GetUserIDFromContext(ctx)
	if err != nil {
		return err
	}

	m.Logger.Infow("checking relationship tuples", "relation", ac.Relation, "object_id", ac.ObjectID)

	access, err := m.Authz.CheckAccess(ctx, ac)
	if err != nil {
		return privacy.Skipf("unable to check access, %s", err.Error())
	}

	if access {
		m.Logger.Debugw("access allowed", "relation", ac.Relation, "object_id", ac.ObjectID)

		return privacy.Allow
	}

	// deny if it was a mutation is not allowed
	return privacy.Deny
}

func (m *GroupSettingMutation) CheckAccessForDelete(ctx context.Context) error {
	ac := fgax.AccessCheck{
		Relation:    fgax.CanDelete,
		ObjectType:  "group",
		SubjectType: auth.GetAuthzSubjectType(ctx),
	}

	gCtx := graphql.GetFieldContext(ctx)

	var ok bool
	ac.ObjectID, ok = gCtx.Args["id"].(string)
	if !ok {
		return privacy.Allowf("nil request, bypassing auth check")
	}

	m.Logger.Debugw("checking mutation access")

	var err error
	ac.UserID, err = auth.GetUserIDFromContext(ctx)
	if err != nil {
		return err
	}

	m.Logger.Infow("checking relationship tuples", "relation", ac.Relation, "object_id", ac.ObjectID)

	access, err := m.Authz.CheckAccess(ctx, ac)
	if err != nil {
		return privacy.Skipf("unable to check access, %s", err.Error())
	}

	if access {
		m.Logger.Debugw("access allowed", "relation", ac.Relation, "object_id", ac.ObjectID)

		return privacy.Allow
	}

	// deny if it was a mutation is not allowed
	return privacy.Deny
}

func (q *IntegrationQuery) CheckAccess(ctx context.Context) error {
	gCtx := graphql.GetFieldContext(ctx)

	if gCtx != nil {
		ac := fgax.AccessCheck{
			Relation:    fgax.CanView,
			ObjectType:  "organization",
			SubjectType: auth.GetAuthzSubjectType(ctx),
		}

		// check id from graphql arg context
		// when all objects are requested, the interceptor will check object access
		// check the where input first
		whereArg := gCtx.Args["where"]
		if whereArg != nil {
			where, ok := whereArg.(*IntegrationWhereInput)
			if ok && where != nil && where.OwnerID != nil {
				ac.ObjectID = *where.OwnerID
			}
		}

		// if that doesn't work, check for the id in the args
		if ac.ObjectID == "" {
			ac.ObjectID, _ = gCtx.Args["ownerid"].(string)
		}

		// if we still don't have an object id, run the query and grab the object ID
		// from the result
		// this happens on join tables where we have the join ID (for updates and deletes)
		// and not the actual object id
		if ac.ObjectID == "" && "id" != "ownerid" {
			// allow this query to run
			reqCtx := privacy.DecisionContext(ctx, privacy.Allow)
			ob, err := q.Clone().Only(reqCtx)
			if err != nil {
				return privacy.Allowf("nil request, bypassing auth check")
			}
			ac.ObjectID = ob.OwnerID
		}

		// request is for a list objects, will get filtered in interceptors
		if ac.ObjectID == "" {
			return privacy.Allowf("nil request, bypassing auth check")
		}

		var err error
		ac.UserID, err = auth.GetUserIDFromContext(ctx)
		if err != nil {
			return err
		}

		access, err := q.Authz.CheckAccess(ctx, ac)
		if err != nil {
			return privacy.Skipf("unable to check access, %s", err.Error())
		}

		if access {
			return privacy.Allow
		}
	}

	// Skip to the next privacy rule (equivalent to return nil)
	return privacy.Skip
}

func (m *IntegrationMutation) CheckAccessForEdit(ctx context.Context) error {
	ac := fgax.AccessCheck{
		Relation:    fgax.CanEdit,
		ObjectType:  "organization",
		SubjectType: auth.GetAuthzSubjectType(ctx),
	}
	orgID, oErr := auth.GetOrganizationIDFromContext(ctx)
	if oErr != nil {
		return oErr
	}

	ac.ObjectID = orgID

	// request is for a list objects, will get filtered in interceptors
	if ac.ObjectID == "" {
		return privacy.Allowf("nil request, bypassing auth check")
	}

	m.Logger.Debugw("checking mutation access")

	var err error
	ac.UserID, err = auth.GetUserIDFromContext(ctx)
	if err != nil {
		return err
	}

	m.Logger.Infow("checking relationship tuples", "relation", ac.Relation, "object_id", ac.ObjectID)

	access, err := m.Authz.CheckAccess(ctx, ac)
	if err != nil {
		return privacy.Skipf("unable to check access, %s", err.Error())
	}

	if access {
		m.Logger.Debugw("access allowed", "relation", ac.Relation, "object_id", ac.ObjectID)

		return privacy.Allow
	}

	// deny if it was a mutation is not allowed
	return privacy.Deny
}

func (m *IntegrationMutation) CheckAccessForDelete(ctx context.Context) error {
	ac := fgax.AccessCheck{
		Relation:    fgax.CanDelete,
		ObjectType:  "organization",
		SubjectType: auth.GetAuthzSubjectType(ctx),
	}

	gCtx := graphql.GetFieldContext(ctx)

	var ok bool
	ac.ObjectID, ok = gCtx.Args["id"].(string)
	if !ok {
		return privacy.Allowf("nil request, bypassing auth check")
	}

	m.Logger.Debugw("checking mutation access")

	var err error
	ac.UserID, err = auth.GetUserIDFromContext(ctx)
	if err != nil {
		return err
	}

	m.Logger.Infow("checking relationship tuples", "relation", ac.Relation, "object_id", ac.ObjectID)

	access, err := m.Authz.CheckAccess(ctx, ac)
	if err != nil {
		return privacy.Skipf("unable to check access, %s", err.Error())
	}

	if access {
		m.Logger.Debugw("access allowed", "relation", ac.Relation, "object_id", ac.ObjectID)

		return privacy.Allow
	}

	// deny if it was a mutation is not allowed
	return privacy.Deny
}

func (q *InviteQuery) CheckAccess(ctx context.Context) error {
	gCtx := graphql.GetFieldContext(ctx)

	if gCtx != nil {
		ac := fgax.AccessCheck{
			Relation:    fgax.CanView,
			ObjectType:  "organization",
			SubjectType: auth.GetAuthzSubjectType(ctx),
		}

		// check id from graphql arg context
		// when all objects are requested, the interceptor will check object access
		// check the where input first
		whereArg := gCtx.Args["where"]
		if whereArg != nil {
			where, ok := whereArg.(*InviteWhereInput)
			if ok && where != nil && where.OwnerID != nil {
				ac.ObjectID = *where.OwnerID
			}
		}

		// if that doesn't work, check for the id in the args
		if ac.ObjectID == "" {
			ac.ObjectID, _ = gCtx.Args["ownerid"].(string)
		}

		// if we still don't have an object id, run the query and grab the object ID
		// from the result
		// this happens on join tables where we have the join ID (for updates and deletes)
		// and not the actual object id
		if ac.ObjectID == "" && "id" != "ownerid" {
			// allow this query to run
			reqCtx := privacy.DecisionContext(ctx, privacy.Allow)
			ob, err := q.Clone().Only(reqCtx)
			if err != nil {
				return privacy.Allowf("nil request, bypassing auth check")
			}
			ac.ObjectID = ob.OwnerID
		}

		// request is for a list objects, will get filtered in interceptors
		if ac.ObjectID == "" {
			return privacy.Allowf("nil request, bypassing auth check")
		}

		var err error
		ac.UserID, err = auth.GetUserIDFromContext(ctx)
		if err != nil {
			return err
		}

		access, err := q.Authz.CheckAccess(ctx, ac)
		if err != nil {
			return privacy.Skipf("unable to check access, %s", err.Error())
		}

		if access {
			return privacy.Allow
		}
	}

	// Skip to the next privacy rule (equivalent to return nil)
	return privacy.Skip
}

func (m *InviteMutation) CheckAccessForEdit(ctx context.Context) error {
	ac := fgax.AccessCheck{
		Relation:    fgax.CanEdit,
		ObjectType:  "organization",
		SubjectType: auth.GetAuthzSubjectType(ctx),
	}
	orgID, oErr := auth.GetOrganizationIDFromContext(ctx)
	if oErr != nil {
		return oErr
	}

	ac.ObjectID = orgID

	// request is for a list objects, will get filtered in interceptors
	if ac.ObjectID == "" {
		return privacy.Allowf("nil request, bypassing auth check")
	}

	m.Logger.Debugw("checking mutation access")

	var err error
	ac.UserID, err = auth.GetUserIDFromContext(ctx)
	if err != nil {
		return err
	}

	m.Logger.Infow("checking relationship tuples", "relation", ac.Relation, "object_id", ac.ObjectID)

	access, err := m.Authz.CheckAccess(ctx, ac)
	if err != nil {
		return privacy.Skipf("unable to check access, %s", err.Error())
	}

	if access {
		m.Logger.Debugw("access allowed", "relation", ac.Relation, "object_id", ac.ObjectID)

		return privacy.Allow
	}

	// deny if it was a mutation is not allowed
	return privacy.Deny
}

func (m *InviteMutation) CheckAccessForDelete(ctx context.Context) error {
	ac := fgax.AccessCheck{
		Relation:    fgax.CanDelete,
		ObjectType:  "organization",
		SubjectType: auth.GetAuthzSubjectType(ctx),
	}

	gCtx := graphql.GetFieldContext(ctx)

	var ok bool
	ac.ObjectID, ok = gCtx.Args["id"].(string)
	if !ok {
		return privacy.Allowf("nil request, bypassing auth check")
	}

	m.Logger.Debugw("checking mutation access")

	var err error
	ac.UserID, err = auth.GetUserIDFromContext(ctx)
	if err != nil {
		return err
	}

	m.Logger.Infow("checking relationship tuples", "relation", ac.Relation, "object_id", ac.ObjectID)

	access, err := m.Authz.CheckAccess(ctx, ac)
	if err != nil {
		return privacy.Skipf("unable to check access, %s", err.Error())
	}

	if access {
		m.Logger.Debugw("access allowed", "relation", ac.Relation, "object_id", ac.ObjectID)

		return privacy.Allow
	}

	// deny if it was a mutation is not allowed
	return privacy.Deny
}

func (q *OrgMembershipQuery) CheckAccess(ctx context.Context) error {
	gCtx := graphql.GetFieldContext(ctx)

	if gCtx != nil {
		ac := fgax.AccessCheck{
			Relation:    fgax.CanView,
			ObjectType:  "organization",
			SubjectType: auth.GetAuthzSubjectType(ctx),
		}

		// check id from graphql arg context
		// when all objects are requested, the interceptor will check object access
		// check the where input first
		whereArg := gCtx.Args["where"]
		if whereArg != nil {
			where, ok := whereArg.(*OrgMembershipWhereInput)
			if ok && where != nil && where.OrganizationID != nil {
				ac.ObjectID = *where.OrganizationID
			}
		}

		// if that doesn't work, check for the id in the args
		if ac.ObjectID == "" {
			ac.ObjectID, _ = gCtx.Args["organizationid"].(string)
		}

		// if we still don't have an object id, run the query and grab the object ID
		// from the result
		// this happens on join tables where we have the join ID (for updates and deletes)
		// and not the actual object id
		if ac.ObjectID == "" && "id" != "organizationid" {
			// allow this query to run
			reqCtx := privacy.DecisionContext(ctx, privacy.Allow)
			ob, err := q.Clone().Only(reqCtx)
			if err != nil {
				return privacy.Allowf("nil request, bypassing auth check")
			}
			ac.ObjectID = ob.OrganizationID
		}

		// request is for a list objects, will get filtered in interceptors
		if ac.ObjectID == "" {
			return privacy.Allowf("nil request, bypassing auth check")
		}

		var err error
		ac.UserID, err = auth.GetUserIDFromContext(ctx)
		if err != nil {
			return err
		}

		access, err := q.Authz.CheckAccess(ctx, ac)
		if err != nil {
			return privacy.Skipf("unable to check access, %s", err.Error())
		}

		if access {
			return privacy.Allow
		}
	}

	// Skip to the next privacy rule (equivalent to return nil)
	return privacy.Skip
}

func (m *OrgMembershipMutation) CheckAccessForEdit(ctx context.Context) error {
	ac := fgax.AccessCheck{
		Relation:    fgax.CanEdit,
		ObjectType:  "organization",
		SubjectType: auth.GetAuthzSubjectType(ctx),
	}

	gCtx := graphql.GetFieldContext(ctx)

	// get the input from the context
	gInput := gCtx.Args["input"]

	// check if the input is a CreateOrgMembershipInput
	input, ok := gInput.(CreateOrgMembershipInput)
	if ok {
		ac.ObjectID = input.OrganizationID

	}

	// check the id from the args
	if ac.ObjectID == "" {
		ac.ObjectID, _ = gCtx.Args["organizationid"].(string)
	}

	// if this is still empty, we need to query the object to get the object id
	// this happens on join tables where we have the join ID (for updates and deletes)
	if ac.ObjectID == "" && "id" != "organizationid" {
		id, ok := gCtx.Args["id"].(string)
		if ok {
			// allow this query to run
			reqCtx := privacy.DecisionContext(ctx, privacy.Allow)
			ob, err := m.Client().OrgMembership.Query().Where(orgmembership.ID(id)).Only(reqCtx)
			if err != nil {
				return privacy.Skipf("nil request, skipping auth check")
			}
			ac.ObjectID = ob.OrganizationID
		}
	}

	// request is for a list objects, will get filtered in interceptors
	if ac.ObjectID == "" {
		return privacy.Allowf("nil request, bypassing auth check")
	}

	m.Logger.Debugw("checking mutation access")

	var err error
	ac.UserID, err = auth.GetUserIDFromContext(ctx)
	if err != nil {
		return err
	}

	m.Logger.Infow("checking relationship tuples", "relation", ac.Relation, "object_id", ac.ObjectID)

	access, err := m.Authz.CheckAccess(ctx, ac)
	if err != nil {
		return privacy.Skipf("unable to check access, %s", err.Error())
	}

	if access {
		m.Logger.Debugw("access allowed", "relation", ac.Relation, "object_id", ac.ObjectID)

		return privacy.Allow
	}

	// deny if it was a mutation is not allowed
	return privacy.Deny
}

func (m *OrgMembershipMutation) CheckAccessForDelete(ctx context.Context) error {
	ac := fgax.AccessCheck{
		Relation:    fgax.CanDelete,
		ObjectType:  "organization",
		SubjectType: auth.GetAuthzSubjectType(ctx),
	}

	gCtx := graphql.GetFieldContext(ctx)

	var ok bool
	ac.ObjectID, ok = gCtx.Args["id"].(string)
	if !ok {
		return privacy.Allowf("nil request, bypassing auth check")
	}

	m.Logger.Debugw("checking mutation access")

	var err error
	ac.UserID, err = auth.GetUserIDFromContext(ctx)
	if err != nil {
		return err
	}

	m.Logger.Infow("checking relationship tuples", "relation", ac.Relation, "object_id", ac.ObjectID)

	access, err := m.Authz.CheckAccess(ctx, ac)
	if err != nil {
		return privacy.Skipf("unable to check access, %s", err.Error())
	}

	if access {
		m.Logger.Debugw("access allowed", "relation", ac.Relation, "object_id", ac.ObjectID)

		return privacy.Allow
	}

	// deny if it was a mutation is not allowed
	return privacy.Deny
}

func (q *OrganizationQuery) CheckAccess(ctx context.Context) error {
	gCtx := graphql.GetFieldContext(ctx)

	if gCtx != nil {
		ac := fgax.AccessCheck{
			Relation:    fgax.CanView,
			ObjectType:  "organization",
			SubjectType: auth.GetAuthzSubjectType(ctx),
		}

		// check id from graphql arg context
		// when all objects are requested, the interceptor will check object access
		// check the where input first
		whereArg := gCtx.Args["where"]
		if whereArg != nil {
			where, ok := whereArg.(*OrganizationWhereInput)
			if ok && where != nil && where.ID != nil {
				ac.ObjectID = *where.ID
			}
		}

		// if that doesn't work, check for the id in the args
		if ac.ObjectID == "" {
			ac.ObjectID, _ = gCtx.Args["id"].(string)
		}

		// if we still don't have an object id, run the query and grab the object ID
		// from the result
		// this happens on join tables where we have the join ID (for updates and deletes)
		// and not the actual object id
		if ac.ObjectID == "" && "id" != "id" {
			// allow this query to run
			reqCtx := privacy.DecisionContext(ctx, privacy.Allow)
			ob, err := q.Clone().Only(reqCtx)
			if err != nil {
				return privacy.Allowf("nil request, bypassing auth check")
			}
			ac.ObjectID = ob.ID
		}

		// request is for a list objects, will get filtered in interceptors
		if ac.ObjectID == "" {
			return privacy.Allowf("nil request, bypassing auth check")
		}

		var err error
		ac.UserID, err = auth.GetUserIDFromContext(ctx)
		if err != nil {
			return err
		}

		access, err := q.Authz.CheckAccess(ctx, ac)
		if err != nil {
			return privacy.Skipf("unable to check access, %s", err.Error())
		}

		if access {
			return privacy.Allow
		}
	}

	// Skip to the next privacy rule (equivalent to return nil)
	return privacy.Skip
}

func (m *OrganizationMutation) CheckAccessForEdit(ctx context.Context) error {
	ac := fgax.AccessCheck{
		Relation:    fgax.CanEdit,
		ObjectType:  "organization",
		SubjectType: auth.GetAuthzSubjectType(ctx),
	}

	gCtx := graphql.GetFieldContext(ctx)

	// check the id from the args
	if ac.ObjectID == "" {
		ac.ObjectID, _ = gCtx.Args["id"].(string)
	}

	// if this is still empty, we need to query the object to get the object id
	// this happens on join tables where we have the join ID (for updates and deletes)
	if ac.ObjectID == "" && "id" != "id" {
		id, ok := gCtx.Args["id"].(string)
		if ok {
			// allow this query to run
			reqCtx := privacy.DecisionContext(ctx, privacy.Allow)
			ob, err := m.Client().Organization.Query().Where(organization.ID(id)).Only(reqCtx)
			if err != nil {
				return privacy.Skipf("nil request, skipping auth check")
			}
			ac.ObjectID = ob.ID
		}
	}

	// request is for a list objects, will get filtered in interceptors
	if ac.ObjectID == "" {
		return privacy.Allowf("nil request, bypassing auth check")
	}

	m.Logger.Debugw("checking mutation access")

	var err error
	ac.UserID, err = auth.GetUserIDFromContext(ctx)
	if err != nil {
		return err
	}

	m.Logger.Infow("checking relationship tuples", "relation", ac.Relation, "object_id", ac.ObjectID)

	access, err := m.Authz.CheckAccess(ctx, ac)
	if err != nil {
		return privacy.Skipf("unable to check access, %s", err.Error())
	}

	if access {
		m.Logger.Debugw("access allowed", "relation", ac.Relation, "object_id", ac.ObjectID)

		return privacy.Allow
	}

	// deny if it was a mutation is not allowed
	return privacy.Deny
}

func (m *OrganizationMutation) CheckAccessForDelete(ctx context.Context) error {
	ac := fgax.AccessCheck{
		Relation:    fgax.CanDelete,
		ObjectType:  "organization",
		SubjectType: auth.GetAuthzSubjectType(ctx),
	}

	gCtx := graphql.GetFieldContext(ctx)

	var ok bool
	ac.ObjectID, ok = gCtx.Args["id"].(string)
	if !ok {
		return privacy.Allowf("nil request, bypassing auth check")
	}

	m.Logger.Debugw("checking mutation access")

	var err error
	ac.UserID, err = auth.GetUserIDFromContext(ctx)
	if err != nil {
		return err
	}

	m.Logger.Infow("checking relationship tuples", "relation", ac.Relation, "object_id", ac.ObjectID)

	access, err := m.Authz.CheckAccess(ctx, ac)
	if err != nil {
		return privacy.Skipf("unable to check access, %s", err.Error())
	}

	if access {
		m.Logger.Debugw("access allowed", "relation", ac.Relation, "object_id", ac.ObjectID)

		return privacy.Allow
	}

	// deny if it was a mutation is not allowed
	return privacy.Deny
}

func (q *OrganizationSettingQuery) CheckAccess(ctx context.Context) error {
	gCtx := graphql.GetFieldContext(ctx)

	if gCtx != nil {
		ac := fgax.AccessCheck{
			Relation:    fgax.CanView,
			ObjectType:  "organization",
			SubjectType: auth.GetAuthzSubjectType(ctx),
		}

		// check id from graphql arg context
		// when all objects are requested, the interceptor will check object access
		// check the where input first
		whereArg := gCtx.Args["where"]
		if whereArg != nil {
			where, ok := whereArg.(*OrganizationSettingWhereInput)
			if ok && where != nil && where.OrganizationID != nil {
				ac.ObjectID = *where.OrganizationID
			}
		}

		// if that doesn't work, check for the id in the args
		if ac.ObjectID == "" {
			ac.ObjectID, _ = gCtx.Args["organizationid"].(string)
		}

		// if we still don't have an object id, run the query and grab the object ID
		// from the result
		// this happens on join tables where we have the join ID (for updates and deletes)
		// and not the actual object id
		if ac.ObjectID == "" && "id" != "organizationid" {
			// allow this query to run
			reqCtx := privacy.DecisionContext(ctx, privacy.Allow)
			ob, err := q.Clone().Only(reqCtx)
			if err != nil {
				return privacy.Allowf("nil request, bypassing auth check")
			}
			ac.ObjectID = ob.OrganizationID
		}

		// request is for a list objects, will get filtered in interceptors
		if ac.ObjectID == "" {
			return privacy.Allowf("nil request, bypassing auth check")
		}

		var err error
		ac.UserID, err = auth.GetUserIDFromContext(ctx)
		if err != nil {
			return err
		}

		access, err := q.Authz.CheckAccess(ctx, ac)
		if err != nil {
			return privacy.Skipf("unable to check access, %s", err.Error())
		}

		if access {
			return privacy.Allow
		}
	}

	// Skip to the next privacy rule (equivalent to return nil)
	return privacy.Skip
}

func (m *OrganizationSettingMutation) CheckAccessForEdit(ctx context.Context) error {
	ac := fgax.AccessCheck{
		Relation:    fgax.CanEdit,
		ObjectType:  "organization",
		SubjectType: auth.GetAuthzSubjectType(ctx),
	}

	gCtx := graphql.GetFieldContext(ctx)

	// get the input from the context
	gInput := gCtx.Args["input"]

	// check if the input is a CreateOrganizationSettingInput
	input, ok := gInput.(CreateOrganizationSettingInput)
	if ok {
		ac.ObjectID = *input.OrganizationID

	}

	// check the id from the args
	if ac.ObjectID == "" {
		ac.ObjectID, _ = gCtx.Args["organizationid"].(string)
	}

	// if this is still empty, we need to query the object to get the object id
	// this happens on join tables where we have the join ID (for updates and deletes)
	if ac.ObjectID == "" && "id" != "organizationid" {
		id, ok := gCtx.Args["id"].(string)
		if ok {
			// allow this query to run
			reqCtx := privacy.DecisionContext(ctx, privacy.Allow)
			ob, err := m.Client().OrganizationSetting.Query().Where(organizationsetting.ID(id)).Only(reqCtx)
			if err != nil {
				return privacy.Skipf("nil request, skipping auth check")
			}
			ac.ObjectID = ob.OrganizationID
		}
	}

	// request is for a list objects, will get filtered in interceptors
	if ac.ObjectID == "" {
		return privacy.Allowf("nil request, bypassing auth check")
	}

	m.Logger.Debugw("checking mutation access")

	var err error
	ac.UserID, err = auth.GetUserIDFromContext(ctx)
	if err != nil {
		return err
	}

	m.Logger.Infow("checking relationship tuples", "relation", ac.Relation, "object_id", ac.ObjectID)

	access, err := m.Authz.CheckAccess(ctx, ac)
	if err != nil {
		return privacy.Skipf("unable to check access, %s", err.Error())
	}

	if access {
		m.Logger.Debugw("access allowed", "relation", ac.Relation, "object_id", ac.ObjectID)

		return privacy.Allow
	}

	// deny if it was a mutation is not allowed
	return privacy.Deny
}

func (m *OrganizationSettingMutation) CheckAccessForDelete(ctx context.Context) error {
	ac := fgax.AccessCheck{
		Relation:    fgax.CanDelete,
		ObjectType:  "organization",
		SubjectType: auth.GetAuthzSubjectType(ctx),
	}

	gCtx := graphql.GetFieldContext(ctx)

	var ok bool
	ac.ObjectID, ok = gCtx.Args["id"].(string)
	if !ok {
		return privacy.Allowf("nil request, bypassing auth check")
	}

	m.Logger.Debugw("checking mutation access")

	var err error
	ac.UserID, err = auth.GetUserIDFromContext(ctx)
	if err != nil {
		return err
	}

	m.Logger.Infow("checking relationship tuples", "relation", ac.Relation, "object_id", ac.ObjectID)

	access, err := m.Authz.CheckAccess(ctx, ac)
	if err != nil {
		return privacy.Skipf("unable to check access, %s", err.Error())
	}

	if access {
		m.Logger.Debugw("access allowed", "relation", ac.Relation, "object_id", ac.ObjectID)

		return privacy.Allow
	}

	// deny if it was a mutation is not allowed
	return privacy.Deny
}

func (q *SubscriberQuery) CheckAccess(ctx context.Context) error {
	gCtx := graphql.GetFieldContext(ctx)

	if gCtx != nil {
		ac := fgax.AccessCheck{
			Relation:    fgax.CanView,
			ObjectType:  "organization",
			SubjectType: auth.GetAuthzSubjectType(ctx),
		}

		// check id from graphql arg context
		// when all objects are requested, the interceptor will check object access
		// check the where input first
		whereArg := gCtx.Args["where"]
		if whereArg != nil {
			where, ok := whereArg.(*SubscriberWhereInput)
			if ok && where != nil && where.OwnerID != nil {
				ac.ObjectID = *where.OwnerID
			}
		}

		// if that doesn't work, check for the id in the args
		if ac.ObjectID == "" {
			ac.ObjectID, _ = gCtx.Args["ownerid"].(string)
		}

		// if we still don't have an object id, run the query and grab the object ID
		// from the result
		// this happens on join tables where we have the join ID (for updates and deletes)
		// and not the actual object id
		if ac.ObjectID == "" && "id" != "ownerid" {
			// allow this query to run
			reqCtx := privacy.DecisionContext(ctx, privacy.Allow)
			ob, err := q.Clone().Only(reqCtx)
			if err != nil {
				return privacy.Allowf("nil request, bypassing auth check")
			}
			ac.ObjectID = ob.OwnerID
		}

		// request is for a list objects, will get filtered in interceptors
		if ac.ObjectID == "" {
			return privacy.Allowf("nil request, bypassing auth check")
		}

		var err error
		ac.UserID, err = auth.GetUserIDFromContext(ctx)
		if err != nil {
			return err
		}

		access, err := q.Authz.CheckAccess(ctx, ac)
		if err != nil {
			return privacy.Skipf("unable to check access, %s", err.Error())
		}

		if access {
			return privacy.Allow
		}
	}

	// Skip to the next privacy rule (equivalent to return nil)
	return privacy.Skip
}

func (m *SubscriberMutation) CheckAccessForEdit(ctx context.Context) error {
	ac := fgax.AccessCheck{
		Relation:    fgax.CanEdit,
		ObjectType:  "organization",
		SubjectType: auth.GetAuthzSubjectType(ctx),
	}
	orgID, oErr := auth.GetOrganizationIDFromContext(ctx)
	if oErr != nil {
		return oErr
	}

	ac.ObjectID = orgID

	// request is for a list objects, will get filtered in interceptors
	if ac.ObjectID == "" {
		return privacy.Allowf("nil request, bypassing auth check")
	}

	m.Logger.Debugw("checking mutation access")

	var err error
	ac.UserID, err = auth.GetUserIDFromContext(ctx)
	if err != nil {
		return err
	}

	m.Logger.Infow("checking relationship tuples", "relation", ac.Relation, "object_id", ac.ObjectID)

	access, err := m.Authz.CheckAccess(ctx, ac)
	if err != nil {
		return privacy.Skipf("unable to check access, %s", err.Error())
	}

	if access {
		m.Logger.Debugw("access allowed", "relation", ac.Relation, "object_id", ac.ObjectID)

		return privacy.Allow
	}

	// deny if it was a mutation is not allowed
	return privacy.Deny
}

func (m *SubscriberMutation) CheckAccessForDelete(ctx context.Context) error {
	ac := fgax.AccessCheck{
		Relation:    fgax.CanDelete,
		ObjectType:  "organization",
		SubjectType: auth.GetAuthzSubjectType(ctx),
	}

	gCtx := graphql.GetFieldContext(ctx)

	var ok bool
	ac.ObjectID, ok = gCtx.Args["id"].(string)
	if !ok {
		return privacy.Allowf("nil request, bypassing auth check")
	}

	m.Logger.Debugw("checking mutation access")

	var err error
	ac.UserID, err = auth.GetUserIDFromContext(ctx)
	if err != nil {
		return err
	}

	m.Logger.Infow("checking relationship tuples", "relation", ac.Relation, "object_id", ac.ObjectID)

	access, err := m.Authz.CheckAccess(ctx, ac)
	if err != nil {
		return privacy.Skipf("unable to check access, %s", err.Error())
	}

	if access {
		m.Logger.Debugw("access allowed", "relation", ac.Relation, "object_id", ac.ObjectID)

		return privacy.Allow
	}

	// deny if it was a mutation is not allowed
	return privacy.Deny
}

func (q *WebhookQuery) CheckAccess(ctx context.Context) error {
	gCtx := graphql.GetFieldContext(ctx)

	if gCtx != nil {
		ac := fgax.AccessCheck{
			Relation:    fgax.CanView,
			ObjectType:  "organization",
			SubjectType: auth.GetAuthzSubjectType(ctx),
		}

		// check id from graphql arg context
		// when all objects are requested, the interceptor will check object access
		// check the where input first
		whereArg := gCtx.Args["where"]
		if whereArg != nil {
			where, ok := whereArg.(*WebhookWhereInput)
			if ok && where != nil && where.OwnerID != nil {
				ac.ObjectID = *where.OwnerID
			}
		}

		// if that doesn't work, check for the id in the args
		if ac.ObjectID == "" {
			ac.ObjectID, _ = gCtx.Args["ownerid"].(string)
		}

		// if we still don't have an object id, run the query and grab the object ID
		// from the result
		// this happens on join tables where we have the join ID (for updates and deletes)
		// and not the actual object id
		if ac.ObjectID == "" && "id" != "ownerid" {
			// allow this query to run
			reqCtx := privacy.DecisionContext(ctx, privacy.Allow)
			ob, err := q.Clone().Only(reqCtx)
			if err != nil {
				return privacy.Allowf("nil request, bypassing auth check")
			}
			ac.ObjectID = ob.OwnerID
		}

		// request is for a list objects, will get filtered in interceptors
		if ac.ObjectID == "" {
			return privacy.Allowf("nil request, bypassing auth check")
		}

		var err error
		ac.UserID, err = auth.GetUserIDFromContext(ctx)
		if err != nil {
			return err
		}

		access, err := q.Authz.CheckAccess(ctx, ac)
		if err != nil {
			return privacy.Skipf("unable to check access, %s", err.Error())
		}

		if access {
			return privacy.Allow
		}
	}

	// Skip to the next privacy rule (equivalent to return nil)
	return privacy.Skip
}

func (m *WebhookMutation) CheckAccessForEdit(ctx context.Context) error {
	ac := fgax.AccessCheck{
		Relation:    fgax.CanEdit,
		ObjectType:  "organization",
		SubjectType: auth.GetAuthzSubjectType(ctx),
	}

	gCtx := graphql.GetFieldContext(ctx)

	// get the input from the context
	gInput := gCtx.Args["input"]

	// check if the input is a CreateWebhookInput
	input, ok := gInput.(CreateWebhookInput)
	if ok {
		ac.ObjectID = *input.OwnerID

	}

	// check the id from the args
	if ac.ObjectID == "" {
		ac.ObjectID, _ = gCtx.Args["ownerid"].(string)
	}

	// if this is still empty, we need to query the object to get the object id
	// this happens on join tables where we have the join ID (for updates and deletes)
	if ac.ObjectID == "" && "id" != "ownerid" {
		id, ok := gCtx.Args["id"].(string)
		if ok {
			// allow this query to run
			reqCtx := privacy.DecisionContext(ctx, privacy.Allow)
			ob, err := m.Client().Webhook.Query().Where(webhook.ID(id)).Only(reqCtx)
			if err != nil {
				return privacy.Skipf("nil request, skipping auth check")
			}
			ac.ObjectID = ob.OwnerID
		}
	}

	// request is for a list objects, will get filtered in interceptors
	if ac.ObjectID == "" {
		return privacy.Allowf("nil request, bypassing auth check")
	}

	m.Logger.Debugw("checking mutation access")

	var err error
	ac.UserID, err = auth.GetUserIDFromContext(ctx)
	if err != nil {
		return err
	}

	m.Logger.Infow("checking relationship tuples", "relation", ac.Relation, "object_id", ac.ObjectID)

	access, err := m.Authz.CheckAccess(ctx, ac)
	if err != nil {
		return privacy.Skipf("unable to check access, %s", err.Error())
	}

	if access {
		m.Logger.Debugw("access allowed", "relation", ac.Relation, "object_id", ac.ObjectID)

		return privacy.Allow
	}

	// deny if it was a mutation is not allowed
	return privacy.Deny
}

func (m *WebhookMutation) CheckAccessForDelete(ctx context.Context) error {
	ac := fgax.AccessCheck{
		Relation:    fgax.CanDelete,
		ObjectType:  "organization",
		SubjectType: auth.GetAuthzSubjectType(ctx),
	}

	gCtx := graphql.GetFieldContext(ctx)

	var ok bool
	ac.ObjectID, ok = gCtx.Args["id"].(string)
	if !ok {
		return privacy.Allowf("nil request, bypassing auth check")
	}

	m.Logger.Debugw("checking mutation access")

	var err error
	ac.UserID, err = auth.GetUserIDFromContext(ctx)
	if err != nil {
		return err
	}

	m.Logger.Infow("checking relationship tuples", "relation", ac.Relation, "object_id", ac.ObjectID)

	access, err := m.Authz.CheckAccess(ctx, ac)
	if err != nil {
		return privacy.Skipf("unable to check access, %s", err.Error())
	}

	if access {
		m.Logger.Debugw("access allowed", "relation", ac.Relation, "object_id", ac.ObjectID)

		return privacy.Allow
	}

	// deny if it was a mutation is not allowed
	return privacy.Deny
}